Re: [RFC] net/bridge: port based vlan filtering for bridges

Stephen Hemminger
2012-04-11T15:30:55Z

On Wed, 11 Apr 2012 11:10:02 -0400
Benjamin LaHaise <bcrl@kvack.org> wrote:

> Hello folks,
>
> Attached is the first stab at a patch to make it possible to filter packets
> received from other bridge ports based on the port number. This can be used
> to emulate port based VLANs that some switches support.
>
> The justification for this is a bit interesting. Initially, I had been
> filtering packets using firewall rules. Unfortunately, the number of
> filter rules becomes impossible to manage when trying to filter traffic
> between 100 different ports. CPU overhead of the filters is also a major
> problem.
>
> The particular use-case I'm dealing with is simulating wireless networks
> on a system using LXC containers. Each guest has a veth device that is a
> member of the bridge, but the topology of which nodes can "hear" each other
> changes at runtime.
>
> Comments/thoughts?
>

Nak. If firewall doesn't work then implement a better netfilter
module.